Nicolas FISCHBACH Senior Manager, Network Engineering Security, COLT Telecom -

Transcription

1 In SPace Nobody Can Hear You Scream Nicolas FISCHBACH Senior Manager, Network Engineering Security, COLT Telecom - v1

2 Internet-wide Security Issues What kept us up at night :) SNMP SQL Slammer (and friends) Cisco wedge bug BGP TCP window [not really actually] Botnets and DDoS 2

3 Internet-wide Security Issues What have we done about it? A lot. Too much maybe? Route/prefix filtering DDoS detection: Netflow DDoS mitigation: BGP (+ MPLS (+ Cleaning)) xacls and MPLS Core hiding QoS and Control Plane Policing (CoPP) BGP TTL trick (GTSM) and BGP TCP md5 Unicast RPF (urpf) Router security 101 3

4 Link types Transit Carrier Backone ISPm Router types Edge Peering (IX or private) ISPy Core Access (/30) ISPj Access ISPa tr cr ixpr Customer (access) Customer (transit) cr cr ccr cpe cpe tr cr cr ar cpe ISPb ppr ccr ar ar cpe cpe ISPy ISPk ISPm cpe 4

5 Carrier Backbone Security receive ACLs [racl] / CoPP infrastructure ACLs [iacl] transit ACLs edge [tacle] transit ACLs access [tacla] BGP (md5 / TTL) Router types Edge Core Access Customer QoS urpf 5

6 Carrier Backbone DDoS Detection Netflow (src/dst IP/port, protocol, ToS, interface - no payload, BPS/PPS/Time) NOC ixpr Flows tr (Sampled) Netflow controller ccr Aggregated Netflow (SNMP) Alerts tr collector collector ar Router types Edge Access ppr ccr ar ar 6

7 DDoS Attack Mitigation ircd/p2p Sampled Netflow Deep Packet Inspection core peering edge internet access layer Server Network Level Mitigation Data Center Level Mitigation 7

8 Carrier Backbone DDoS Mitigation Flows ixpr tr cr Attack traffic Good traffic cr Bad traffic cr ccr tr cr cr ppr ccr ar ar VoIP Router types Edge inspection Access Core 8

9 Internet-wide Security Issues What has really changed? Route filtering : quite relax still DDoS detection, but weak mitigation : DDoS == background noise QoS : not for security, but for NGN CoPP : not widely deployed urpf : not widely deployed BGP : md5 common (but useful?), TTL-trick (the exception) 9

10 Internet-wide Security Issues Have we learned the lesson? IPv6 Lots of security features in software (not in hardware) Will we ever see SoBGP / Secure BGP? Do we need it? Going up the stack, no mitigation at network level anymore (everything on top of 80/tcp, DNS attacks, etc) 10

11 What's the driver? Security Features How to get those features across product ranges and vendors Shift of features towards edge, access, last/first mile But these features are not (often) security features Devices that never saw the bad Internet Features vs power vs cooling Hardware limitations (FPGA, ASIC, NP) 11

12 Security which future? No big nation-wide critical infrastructure issue recently IP/Data network infrastructure has become a commodity (until it's down) No focus on infrastructure security anymore (but the wake up call will be funny ) So where do people put security research and resources into? 12

13 NGN (Next Generation Networks) 13

14 NGNs Next Generation Networks VoIP and IMS Ethernet/DSL services Converged Networks Moving up and down the stack at the same time 14

15 TDM PSTN PBX Trunking over IP Voice Switch PRI (ISDN over E1) PBX POTS VoIP/ToIP DTMF Softswitch H.323(/MGCP) 64kUR (PBX Mgmt) TDM PSTN Voice Switch MGW MGCP RTP F W Internet H.323(/MGCP)/RTP PBX CPE No NAT T.38 (FAX) 15

16 TDM PSTN Wholesale Voice over IP Voice Switch PRI (ISDN over multiple E1s or STM-1s) Voice Switch TDM PSTN POTS VoIP/ToIP SIP Softswitch TDM PSTN Voice Switch MGCP MGW RTP MGW S B C Internet SIP/RTP H.323/RTP Other Carrier VoIP Core 16

17 VoIP protocols Security challenges No, VoIP isn't just SIP SIP is a driver for IMS services and cheap CPEs H.323 and MGCP (still) rock the carrier world Security issues VoIP dialects Only a couple of OEM VoIP stacks (think x-vendor vulnerabilities) FWs / SBCs: do they solve issues or introduce complexity? Are we creating backdoors into customer networks? CPS and QoS 17

18 Session Border Controller What the role of an SBC? Security Hosted NAT traversal (correct signalling / IP header) Signalling conversion Media Conversion Stateful RTP pin-holing based on signalling Can be located at different interfaces: Customer/Provider, inside customer LAN, Provider/Provider (VoIP peering) What can be done on a FW with ALGs? 18

19 IMS services IMS = IP Multimedia Subsystem Remember when the mobile operators built their WAP and 3G networks? Mostly open (aka terminal is trusted) Even connected with their internal /IT network IMS services with MVNOs, 3G/4G: overly complex architecture with tons of interfaces Large attack surface: registration/tracking servers, application servers, etc Firewalling: complex if not impossible 19

20 IMS Future Threats FMC: Attack Fixed<->Mobile handover (GSM<->WiFi) Vishing (VoIP Phishing): risks associated with IVR Abusing IN systems 20

21 MSP and IP DSLAM Multi-Service Platform aka Carrier Ethernet IP/Ethernet DSLAMs Remember all the LAN only layer 2 attacks? dsniff is not dead ;-) VLANs, TCAM, etc. Basic IP features DSLAMs 21

22 Conclusion Last 5 years : infrastructure security Next 5 years : NGN security In a couple of years : learn the hard way that NGN needs stable and secure underlying infrastructure 22